TCP/IP Fingerprint: Windows, macOS, iOS, Linux
Every Stat Proxies IP sends a Windows 11 TCP/IP fingerprint by default. Add -os-macos, -os-ios, or -os-linux to your username to pick another OS per connection. Free on every plan.
Frequently asked questions
What is a TCP/IP fingerprint?
It is the set of values an operating system puts in the first packet of every TCP connection: the TTL, the window size, the order of the TCP options, whether timestamps are on, and the source port. Each OS uses different defaults, so a website can tell Windows, macOS, and Linux apart from that one packet without running any JavaScript.
Do the fingerprint profiles cost extra?
No. Every profile is included on every IP on every plan at no extra cost, the same way SOCKS5 is.
Do I need to turn it on?
No. Every connection our servers open to a website gets the Windows 11 fingerprint unless you ask for something else, over HTTP, HTTPS, and SOCKS5.
How do I pick macOS, iOS, or Linux instead?
Add -os-macos, -os-ios, or -os-linux to the end of your proxy username. Your password, host, and port stay the same, and there is no new order. The profile applies per connection, so one IP can carry Windows and macOS connections at the same time under different usernames.
What if my user agent says Mac or iPhone?
With no suffix in the username, an HTTP or HTTPS request whose User-Agent clearly names macOS or iOS gets that profile. For HTTPS, our server reads the User-Agent on the CONNECT request, which browsers send and many HTTP libraries do not. A suffix always wins over the User-Agent, so add -os-macos or -os-ios to be explicit, or -os-windows to force Windows.
Is there an Android profile?
Not yet. A username ending in -os-android is rejected with HTTP 407 (an authentication failure on SOCKS5), so no traffic goes out with the wrong fingerprint. Until Android is available, Android User-Agents get the Linux profile, the closest match.
Does it work with SOCKS5 and UDP?
It applies to every TCP connection, including TCP over SOCKS5. Use the same username suffix on port 1080. SOCKS5 has no User-Agent, so without a suffix it uses Windows. UDP has no TCP handshake, so DNS, WebRTC, and HTTP/3 traffic over SOCKS5 UDP is not affected.
How can I check it?
Send a request through your proxy to https://tls.peet.ws/api/all and read the tcp_syn block. With the default Windows profile you should see a window of 65535, window scale 8, timestamps false, and the option order mss, nop, wscale, nop, nop, sackOK. The TTL shows as 128 minus the number of hops to their server, usually somewhere between 110 and 125. With -os-macos you should see window scale 6 and timestamps true. With -os-linux, a window of 64240 and window scale 7.
Will it get me past Cloudflare or other anti-bot systems?
It removes one signal: a browser claiming one OS while arriving on another OS's TCP stack. Anti-bot systems also score your IP history, TLS fingerprint, browser environment, and behavior, and a proxy controls none of those except the IP. Treat it as one less thing that can give you away, not a bypass.